Internet Segura
Educator's Kit
Open by saying who you are, where you speak from and why you agreed to lead this conversation. The kit belongs to Casa Hacker, but the training is yours.
// chapter 00
Educator's Kit
Internet Segura
Open by saying who you are, where you speak from and why you agreed to lead this conversation. The kit belongs to Casa Hacker, but the training is yours.
// Why start here
How many times a day do you pick up your phone?
Collect guesses on paper. The average measured in studies is over 150 times. Don't reveal it before hearing the room.
// Why start here
The internet became the public square
- 9 in 10 Brazilian homes have internet
- It's where you book a doctor's appointment, look for a job, get the message from school
- For children and teenagers, it is the main place where they spend time together
- Nobody taught anybody how to cross this square
The data comes from TIC Domicílios and TIC Kids Online, by Cetic.br. Update with the latest edition before presenting.
// Why start here
What the law already says
- Marco Civil, art. 26: educating for safe and conscious use is a duty of the State
- ECA, Brazil's Child and Adolescent Statute: children's rights apply on and off the internet
- Law 13,185/2015: preventing bullying, including online, is a legal duty
- ECA Digital, Law 15,211/2025: new rules for the platforms
No need to memorize it. The point is that teaching this is not a favor; it is the obligation of anyone who looks after people.
// Why start here
Banning doesn't educate. Educating protects.
This is the sentence that sums up Casa Hacker's stance. Come back to it whenever the conversation slides into fear.
// Why start here
How Casa Hacker does it
- Listen first: what worries this territory?
- A dialogue circle with those who educate and those who care
- Free, in-person training
- Each person leaves with this kit and multiplies it
This is the path the program follows in every city. Anyone who wants to bring it to their territory can write to falae@casahacker.org.
// chapter 01
What is yours, and what you hand over
Privacy and data
// Privacy and data
Privacy is a right
- Privacy is a right and a culture. It is in the Constitution and in the LGPD, Brazil's data protection law
- Security is the means, the tools that guarantee that right
- What is private for one person may not be for another, and that is fine
The distinction between right and tool helps the room understand that a strong password is not the end, it is the beginning.
// Privacy and data
Three boxes
- Public: what poses no risk if everyone knows it
- Private: what needs care and choice
- Intimate: what must stay protected, always
Run the three-boxes activity here. Let the room disagree.
// Privacy and data
Glass walls on your phone
Show the photo of the transparent bathroom. Ask why we accept on the phone what we would not accept in the public square.
// Privacy and data
There is no free lunch
- The app is free because the product is you
- Every like, search and pause on a video becomes a data point about your tastes
- That profile is sold to whoever wants to sell to you, or to persuade you
- Digital listening is the name for this
The example of broadcast TV helps older people understand the model. The commercials paid for the soap opera; today your data pays for the app.
// Privacy and data
Is this only about ads?
- Political campaigns use the same data to choose what you see
- The more they know, the more they can influence
- That is how the Cambridge Analytica case worked, with a personality quiz
Source, Data Detox Kit. Avoid taking sides; the point is the mechanism, not the candidate.
// Privacy and data
What you can do today
- Review who sees your posts
- Turn off location in apps that don't need it
- Delete apps you no longer use
- See and clear your history at myactivity.google.com
- Think twice before posting a photo of a child
Ask the room to do at least one of these right there, on their phones. A good training changes a setting before it ends.
// chapter 02
The front door
Accounts and passwords
// Accounts and passwords
What's behind the door
- Your email, and through it the recovery of every other account
- Your photos, conversations and documents
- Your card and your bank
- Your name, for anyone who wants to pass as you
Email is the master key. Whoever gets in changes the password to everything else.
// Accounts and passwords
15 points for the worst password in the world
Rules: 4 points for the name, 2 for the CPF, 6 for the pet, 8 for the birthday. Whoever spends everything wins. Then show that all of this is on almost everyone's public profile.
// Accounts and passwords
A strong password, in one line
- Long: 12 characters or more
- One for each account. Just one, and if one leaks, they all leak
- Unexpected words strung together beat a symbol at the end
- Nothing that's on your profile
A good example: four unrelated words, like "brick-popcorn-fog-42". Easy to remember, hard to guess.
// Accounts and passwords
The second key
- Two-step verification (2FA) asks for a code in addition to the password
- Turn it on for email, banking, WhatsApp and social networks
- Prefer an authenticator app over SMS
- Keep the recovery codes on paper
Ask people to turn on WhatsApp's two-step verification right there. It takes two minutes, and WhatsApp cloning is the most common scam in the country.
// Accounts and passwords
haveibeenpwned.com
Do it live with your own email. Almost everyone shows up in some leak. It's nothing to be ashamed of; it's a reason to change the password for that service.
// Accounts and passwords
Password manager
- A vault with one strong master password
- It creates and remembers different passwords for each account
- Bitwarden (free, in Portuguese) or KeePassXC (no internet needed)
- A piece of paper kept at home is a password manager too, and it beats reusing a password
Don't look down on the little notebook. For older people, a notebook kept in a drawer is safer than the same password everywhere.
// chapter 03
Social engineering and phishing
Scams
// Scams
The weakest link isn't the system
- Breaking into a bank is hard. Convincing a person to hand over their password is easy
- Social engineering is the name for this manipulation
- It targets haste, fear and goodwill
Nobody falls for a scam out of stupidity. They fall out of trust and haste. Saying this takes the shame out of the room and opens the conversation.
// Scams
The bait always looks the same
- Urgency: "your account will be blocked today"
- Authority: bank, government, boss, son or daughter
- A link or a file to open
- A request for a code, password or payment
- A story too good, or too scary
Ask for examples. Everyone got one this week.
// Scams
Phishing and its cousins
- Phishing: a fake email or website "fishing" for your data
- Smishing: the same, by SMS
- Vishing: by phone call, the "manager" asking you to confirm
- Whaling: posing as a director to fool an employee
No need to memorize the names. What matters is recognizing the pattern on any channel.
// Scams
The WhatsApp scam
- "Hi mom, I changed my number, can you send me a Pix?"
- The six-digit code they "sent by mistake"
- A cloned profile with your photo asking your friends for money
- Defense: two-step verification and calling back on the old number
It's the most common scam in the country. Tell a concrete case from the territory, if you have one.
// Scams
Seven questions before you click
- Who really sent it? Look at the whole address
- Do I use this service? Do I really owe this company?
- Are there spelling mistakes or a crooked logo?
- Where does the link go? Hold your finger on it without clicking
- Are they asking for a password or a code? No serious company does
- Can I confirm through another channel? Then confirm
- Is there a rush? The rush is the bait
This is the list to print out and stick on the community center's fridge.
// Scams
When in doubt, don't click. Type.
Opening the browser and typing the bank's address yourself defeats most scams.
// chapter 04
Check before you share
Disinformation
// Disinformation
"A vida é a arte do encontro…" ("Life is the art of encounter…") — Clarice Lispector
Ask who has seen it. Then tell them it is by Vinicius de Moraes. If a quote can fool us, imagine a news story.
// Disinformation
What disinformation is
- False or distorted information, made to confuse or mislead
- It is not just "fake news". There is satire taken seriously, a headline that doesn't match the text, a real photo in a false context
- It spreads because it stirs emotion, not because it is true
Emotion is the engine. The more anger or fear a piece of content provokes, the faster it travels.
// Disinformation
Seven types
- Satire or parody taken seriously
- Biased content
- Impostor content (fake source)
- Fabricated content
- False connection (headline and text don't match)
- Manipulated content (altered photo or video)
- Rumor
The typology is by researcher Claire Wardle, of First Draft. It helps the room see that "lying" is not one single thing.
// Disinformation
Five questions
- Author: is it clear who wrote it? Are they an expert? Do they have a reputation?
- Accuracy: are the photos real? Do other reliable sources say the same?
- Objectivity: is the information complete, or just a piece of it?
- Currency: when was it created? Does it still hold?
- Coverage: is the topic explained in depth, or is it just a headline?
This is the checklist from Casa Hacker's 2021 booklet. Print it and stick it on the wall of your space.
// Disinformation
Someone has already checked for you
- Comprova, Aos Fatos, Agência Lupa, Estadão Verifica, Agência Pública, E-farsas
- Reverse image search on TinEye or Google Images
- Before sharing, search for the headline in quotation marks
Show a fact-check live. Pick a piece of content that circulated this week.
// Disinformation
Burst your bubble
- The app shows you what you already like. That is algorithmic curation
- Over time, you only see people who agree with you
- Follow sources outside your circle, on purpose
A concrete suggestion, Global Voices in Portuguese.
// Disinformation
10 × 10 = 100 people in seconds. And there is no taking it back.
Run the snowball activity. Sharing is not commenting; it is editing a newspaper with your own name on it.
// chapter 05
Your phone was built to hold on to you
Digital well-being
// Digital well-being
Guess versus dashboard
- How many hours a day do you think you use your phone?
- Now open the screen-time dashboard and look
- The gap is the topic
Android: Settings → Digital Wellbeing. iPhone: Settings → Screen Time. Do it with your own device first.
// Digital well-being
Designed to seduce
- Every color, sound and vibration was tested to make you come back
- Infinite scroll has no end on purpose
- The red notification badge mimics a danger alert
- The "seen by" and the like use the same reward as a slot machine
It is not a conspiracy. It is the business model, called persuasive design. The longer you stay, the more ads you see.
// Digital well-being
Is it your fault for liking it?
Let the room answer. Steer toward "liking it is not a fault; the question is who profits and what I want".
// Digital well-being
Signs it has gone too far
- Picking up the phone for no reason, "just to check"
- Poor sleep, phone in bed until late
- Irritation when the battery dies or the internet drops
- Constant comparison with other people's lives
- Children who only calm down with a screen
Speak without judgment. Everyone in the room will recognize themselves in at least one item, you included.
// Digital well-being
What you can change today
- Turn off notifications from anything that isn't a person
- Black-and-white screen at night, night light
- Phone out of the bedroom at bedtime
- A daily limit on one app, just to measure
- One screen-free time in the household routine
Ask each person to pick one item and do it right there. The notification is the easiest.
// Digital well-being
It is not a lack of discipline. It is design working against you.
Close with the idea that responsibility is not only individual; that is why regulation exists, such as the ECA Digital.
// chapter 06
Recognize, mediate, record
Cyberbullying
// Cyberbullying
thispersondoesnotexist.com
Reload the site a few times. None of those faces belongs to a real person. Ask how the room would know who they are talking to.
// Cyberbullying
Teasing or violence?
- Intentional: it means to disturb, intimidate or hurt
- Repeated: it happens again and again
- Unequal: one side has more power, more people or more reach
- All three together are bullying. Through a screen, cyberbullying
Run the cards activity. The cases where the room disagrees are the ones that teach.
// Cyberbullying
Why the screen makes it worse
- There is no going home; the aggression carries on at night
- One humiliation becomes a thousand in minutes
- It stays recorded; the victim runs into it again later
- The aggressor doesn't see the face of the person they hurt
The multiplier effect is what sets cyberbullying apart from schoolyard bullying.
// Cyberbullying
Signs that show up first
- Withdrawal, disappearing from gatherings
- Sudden change in phone use, up or down
- Drop in performance, poor sleep
- Unusual irritation or aggressiveness
- Fear of going to a certain place or group
Those who educate see these signs before the family does, because they see the person in the group.
// Cyberbullying
What the law requires of those who educate
- Law 13,185/2015: preventing is a legal duty, not a favor
- Train the team, discuss it with the group, record the cases
- Psychological, social and legal assistance for victim and aggressor
- Educational institutions: reports every two months
The law applies to schools, but its spirit applies to any space that brings children and adolescents together.
// Cyberbullying
Mediate before litigating
- First, make sure the victim is safe and supported
- Separate conversation with each side, no audience
- Bring families in as allies, not defendants
- Record everything, with dates
- Risk to life or threats: police, Conselho Tutelar (the local child protection council) or Ministério Público (the public prosecutor's office) right away
Between 12 and 18 it is an infraction under juvenile law; the family is civilly liable. But most cases are resolved with good mediation and a record.
// Cyberbullying
Those who see and stay silent take part.
Close with the bystander activity. Cyberbullying's strength is its audience; taking the audience away is what young people can do on their own.
// chapter 07
For the adult who educates
Sexuality and violence on the internet
Tell the room that this block is for adults and deals with sexual violence. If adolescents are present, adapt or skip it.
// Sexuality and violence
Where the first time happens
- For adolescents, the internet is the space of first experiences, including romantic and sexual ones
- Exchanging intimate images can be a legitimate part of discovering one's own body
- The problem is never the photo. It is what is done with it without consent
Starting without moralizing is what allows an adolescent to tell you when something goes wrong.
// Sexuality and violence
It is not pornography. It is a crime.
- Sharing nudity without consent is a crime (Law 13,718/2018)
- Calling it "revenge porn" hides that; it is violence
- With anyone under 18, it is sexual violence against a child or adolescent
- Producing, sharing and even keeping it: ECA, articles 240 and 241
Sentences. Producing, 4 to 8 years. Sharing, 3 to 6. Storing, 1 to 3. No need to memorize them; you need to know that keeping it is also a crime.
// Sexuality and violence
The aggressor is to blame. Always.
Repeat it as many times as needed. Blaming the victim is what makes them stay silent.
// Sexuality and violence
Risks with names
- Grooming: an adult who approaches a child online in order to abuse them
- Sextortion: blackmail with an intimate image
- Sexting: exchanging intimate messages, which becomes a risk when it leaks
- Exposure to inappropriate content, luring, trafficking
Naming helps you recognize. Each of these has a reporting path in the next chapter.
// Sexuality and violence
The duty of those who educate
- Education and health professionals have a legal duty to report violence against children and adolescents
- Welcome, protect the victim, guide the family, refer
- Proportional intervention; don't expose the victim a second time
- Conselho Tutelar, Ministério Público, police station, as the case requires
Reporting is not turning the adolescent in. It is protecting them. Tell your team that.
// Sexuality and violence
The platform has to take it down
- Marco Civil, art. 21: the victim asks the platform directly for removal, no judge needed
- If the platform doesn't act, it becomes liable
- Save the address before requesting removal
This is what many people don't know, and it is what stops the exposure fastest.
// Sexuality and violence
Don't be a bystander
- If you receive it, don't share it. Report the link and delete it
- Don't blame, don't comment, don't ask "why did you send it?"
- Talk to the person in private. Offer concrete help
Circulation depends on each person who passes it on. Breaking the chain is what the group can do.
// chapter 08
Reporting step by step
What to do
// What to do
Before anything else
- Don't reply, don't retaliate, don't take justice into your own hands. It only escalates the violence
- A victim under 18 asks a trusted adult for help
- The adult listens, supports and walks through the steps together with the family
The adult's calm is the first remedy. Haste is the aggressor's weapon.
// What to do
1. Save the evidence
- Don't delete content or conversations
- Screenshots with date and time visible
- Copy the exact address (URL) of every post and of the profile
- Keep e-mails and messaging-app conversations
Page, profile, video, everything has an address. Copy the whole thing, from "https" to the end.
// What to do
Sexual content involving someone under 18: only the victim or the legal guardian may keep it.
Keeping or forwarding an intimate image of a teenager, even as evidence and with good intentions, is the crime of possession. The educator tells the family to keep it; the educator does not keep it.
// What to do
2. Record it with a notary
- An ata notarial, a notarized record, gives the evidence official weight
- The notary checks address, content, date and place
- Worth more than a loose screenshot when the case reaches court
It costs money. For families without means, the Defensoria Pública, the public defender's office, can point to alternatives.
// What to do
3. Block and 4. Report to the platform
- Block the aggressors so the victim stops receiving
- Every platform has a report button; non-consensual nudity breaks the rules of all of them
- Marco Civil, art. 21: once notified, the platform has to take it down
- If that doesn't work, an extrajudicial notice sent by a lawyer
Reporting to the platform is free, immediate and often enough to stop the spread.
// What to do
5. Police report
- Cybercrime or women's police station, if your city has one; any police station will do
- Children and teenagers can file one, and so can anyone close to them
- Bring the evidence
Many cities have an online police station. Show how to find the one for your state.
// What to do
6. Ask search engines for removal and 7. Support network
- Google's form removes the content from results tied to the victim's name
- It does not remove it from the original page; that's why reporting to the platform comes first
- Friends, family and the community itself; professional help if the pain is bigger than the person
The support network is what prevents the tragic ending. It is not an optional step.
// What to do
8. Who to turn to
- Your city's Conselho Tutelar, the municipal child protection council
- Disque 100 (human rights) and Disque 180 (violence against women)
- Safernet: anonymous reporting and helpline
- Ministério Público and Defensoria Pública
- Risk to life: 190
Write down the local phone numbers of the Conselho Tutelar and the police station before the training. Every city is different.
// What to do
Received it? Don't share. Report the link. Delete.
Closing. The victim is never to blame. The aggressor is. Always.
// chapter 09
The law, the year, and what it asks of those who educate
The law on one page
// Legislation
Marco Civil da Internet (2014)
- The "constitution" of the Brazilian internet
- Art. 26: educating for safe and conscious use is a duty of the State
- Art. 21: a victim of non-consensual nudity asks the platform directly for removal
This is the law that gives legal grounding to the training you are running right now.
// Legislation
ECA (1990) and ECA Digital (2025)
- Children's rights apply on and off the network
- Arts. 240 and 241: producing, sharing and storing a sexual image of a minor is a crime
- Lei 15.211/2025: age verification, guardian supervision, an end to advertising aimed at minors
The ECA Digital came into force in March 2026. Regulations from the ANPD, Brazil's data protection authority, are still coming out; check before presenting.
// Legislation
Bullying and sexual harassment
- Lei 13.185/2015: preventing bullying and cyberbullying is a legal duty; institutions train, record and assist
- Lei 13.718/2018: sexual harassment and sharing scenes of sex or nudity without consent are crimes
The two laws that come up most in the cases that reach educators.
// Legislation
LGPD (2018)
- Personal data is only collected with a purpose and a legal basis
- A child's data requires the guardian's specific consent
- Applies to the school, the social project and the collective that keep a list of students
Those who educate also process data. An attendance list with CPF (taxpayer ID) numbers is personal data.
// Legislation
What to do until the regulations arrive
- Know the topics: cyberbullying, harassment, exploitation, grooming
- Ongoing training in the territory, with educators, managers and families
- Guardian supervision as a practice of care
- Follow the ANPD and understand the mechanisms platforms will put in place
These are Casa Hacker's recommendations for the ECA Digital transition period.
// Legislation
The internet is not a lawless land.
Digital traces let the police, the Ministério Público and the courts reach those responsible. Say that to victims and to potential aggressors alike.
// chapter 10
From age 6 to community leaders. For circles, classrooms, collectives and talks.
Activity plans
// Activities
One structure, many formats
- Every plan has a goal, duration, materials, a timed step by step, questions and variations
- Materials are the bare minimum: paper, pen and a phone
- Works for talking circles, classrooms, collectives, street activities and talks
Show the plans page and explain the filter by age group and format.
// Activities
By age group
- Ages 6 to 8: what is a secret and what is a story
- Ages 9 to 11: the profile detective
- Ages 12 to 14: joke or violence?
- Ages 15 to 17: the bubble and the fact-check
- Adults and families: the front door
- Community leaders: multiplying in the territory
People can start with any of them. Our suggestion, start with your own age group, because nobody teaches what they haven't done.
// Activities
Nobody has to show their own screen.
In every activity, the phone is a tool, never evidence. That is what gets people to tell the truth.
// Activities
Adapt, run it, tell us about it
- Swap the examples for ones from your territory
- Record what happened in three lines
- Send it to falae@casahacker.org
The kit is alive. Every report from the field becomes an improvement in the next version.
// chapter 11
To keep going from here
Resources and further reading
// Resources
Kits and methodologies
- Data Detox Kit (Tactical Tech), in Portuguese
- The Glass Room and What The Future Wants
- Security in a Box and Holistic Security
- Cartilha de Segurança para Internet and Internet Segura, from NIC.br
All free. The Data Detox is the foundation of this kit.
// Resources
Tools
- haveibeenpwned.com: has my e-mail leaked?
- Bitwarden and KeePassXC: password managers
- myactivity.google.com: what Google has kept
- TinEye: where did this image come from?
Show each one working. Thirty seconds per tool.
// Resources
Who fact-checks
- Comprova, Aos Fatos, Agência Lupa
- Estadão Verifica, Agência Pública, E-farsas
- EducaMídia, for lesson plans
Ask everyone to follow one agency before leaving the room.
// Resources
Where to report and ask for help
- Safernet: anonymous reporting and helpline
- Conselho Tutelar, Disque 100, Disque 180
- Google's removal forms
Write your city's Conselho Tutelar and police station phone numbers on this slide before presenting.
// Resources
To watch and talk about
- The Social Dilemma
- The Great Hack
- Coded Bias
- Expresso Futuro (Globoplay)
A film and a talking circle afterwards is a whole training session.
// Resources
casahacker.org/internetsegura · falae@casahacker.org
CC BY-SA 4.0 license. Copy, adapt, print, multiply. Just credit the source and keep the license.
Banning doesn't educate. Educating protects.
- casahacker.org/internetsegura
- falae@casahacker.org
- CC BY-SA 4.0 licence: copy, adapt, multiply
Leave this slide on screen during questions. Note down who wants to bring the training to their own territory.